Skip to content

Support Session Revocation Unavailable

URI: https://docs.ankatech.co/errors/impersonation-session-revocation-unavailable
HTTP Status: 503 Service Unavailable

When you see this

You asked to end a live support-access session, or to withdraw the authorisation behind one, and the session's access token could not be revoked. Nothing was applied. The authorisation and any open session are exactly as they were before the request.

Both DELETE /api/v3/admin/tenants/{tenantId}/support-access/sessions/current and DELETE /api/v3/admin/tenants/{tenantId}/support-access/grants/current declare this status.

Why this is not a 500

Revocation writes the token to the blacklist first and lets a failure propagate. That failure is a data-access fault, and a data-access fault answered generically would tell the tenant the platform had a bug on the one path where the honest answer is "the credential could not be revoked, nothing was applied, retry". A caller cannot act on "an internal data access error occurred"; it can act on this.

The operation is atomic in the safe direction: because the revocation is attempted first, a failure leaves the whole withdrawal un-applied rather than half-applied.

There is no Retry-After. The outage is not one this service can put a number on, and a fabricated interval is worse than none on a control the caller must not stop retrying.

Common Causes

  • The session store backing the token blacklist is unreachable or is refusing writes.
  • A transient fault in that store during the request.

Response Example

{
  "type": "https://docs.ankatech.co/errors/impersonation-session-revocation-unavailable",
  "title": "Support Session Revocation Unavailable",
  "status": 503,
  "detail": "The support session could not be terminated because its access token could not be revoked. NOTHING was applied — the authorisation and any open session are unchanged. Retry the request; if it keeps failing, contact the platform operator.",
  "instance": "/api/v3/admin/tenants/2f1c9d84-6b2e-4d3a-9f57-0a1b2c3d4e5f/support-access/sessions/current",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. This is an Admin API body, so the correlation identifier is extensions.requestId; see Error Index & Overview.

The body names no session, no token identifier and no tenant. The real fault is logged with the correlation identifier and never appears in the response.

How to Resolve

  1. Retry the request. The support session is still live until a revocation succeeds, so do not stop at the first failure.
  2. If it keeps failing, contact the platform operator immediately — a support session that cannot be ended is an access that is still open.
  3. For an operator: check the session store's availability, then confirm the revocation landed by re-reading the tenant's support-access state.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.